CVE-2023-3519 KEVRansomwarePublic exploit Critical · 9.8 EPSS 99.7%

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Citrix · NetScaler ADC and NetScaler Gateway

Summary

A code injection flaw in Citrix NetScaler ADC and NetScaler Gateway allows an attacker to inject and run code on affected appliances. The attack requires only network access to the device, with no authentication, no user interaction, and no special configuration.

Official description · NVD

Unauthenticated remote code execution

Breakdown

89.9 / 100

Exploited: Yes, in CISA KEV
Reports: 6
Tactics: 5/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource data149 general detection rules
- Hijack how programs load codeT1574 · Hijack Execution FlowSource data8 general detection rules
What they do
- Download more tools onto the systemT1105 · Ingress Tool TransferSource data87 general detection rules
What can follow
- List domain accountsT1087.002 · Domain AccountSource data21 general detection rules

First seen exploited 1 day before it was disclosed. Public exploit code (Metasploit) was available 1 day before disclosure.

First seen exploitedVulnCheck KEV evidencePublic exploit codeMetasploit18 Jul 20231 day before
DisclosedAdded to CISA KEVknown ransomware use; EU database agrees19 Jul 2023day 0
First dated threat reportsocradar.io24 Jan 2024+6 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

4 , grouped by in kill-chain order 4

Initial AccessTA0001

Exploit Public-Facing Application T1190

MITRE CTID mapping of the KEV entry · how it is exploited

This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow. Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data.

ExecutionTA0002

Hijack Execution Flow T1574 also Stealth

MITRE CTID mapping of the KEV entry · how it is exploited

DiscoveryTA0007

Domain Account T1087.002

MITRE CTID mapping of the KEV entry · follow-on activity

Command and ControlTA0011

Ingress Tool Transfer T1105

MITRE CTID mapping of the KEV entry · primary impact

Detection

0 rules for this CVE · 265 general rules for its techniques

Rules for this CVE

0 that reference CVE-2023-3519 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Hijack Execution FlowT15748 general rules

Exploiting SetupComplete.cmd CVE-2019-1378hightest
Potential PrintNightmare Exploitation Attempthightest
Suspicious Printer Driver Empty Manufacturerhightest
DLL Execution Via Register-cimprovider.exemediumtest
Potential Initial Access via DLL Search Order Hijackingmediumtest
Potential Registry Persistence Attempt Via DbgManagedDebuggermediumtest
Regsvr32 DLL Execution With Uncommon Extensionmediumtest
Windows Spooler Service Suspicious Binary Loadinformationaltest

Ingress Tool TransferT110587 general rules

Greenbug Espionage Group Indicatorscriticaltest
Pandemic Registry Keycriticaltest
Curl Download And Execute Combinationhightest
File Download And Execution Via IEExec.EXEhightest
File Download From IP Based URL Via CertOC.EXEhightest
File Download Using Notepad++ GUP Utilityhightest
File Download Via Bitsadmin To A Suspicious Target Folderhightest
File Download Via Windows Defender MpCmpRun.EXEhightest

All 87 on SigmaHQ ↗

Domain AccountT1087.00221 general rules

AD Privileged Users or Groups Reconnaissancehightest
BloodHound Collection Fileshightest
HackTool - Bloodhound/Sharphound Executionhightest
Malicious PowerShell Commandlets - PoshModulehightest
Malicious PowerShell Commandlets - ProcessCreationhightest
Malicious PowerShell Commandlets - ScriptBlockhightest
PUA - AdFind Suspicious Executionhightest
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXEhightest

All 21 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 6 threat reports

6 reportsZscaler3Trend Microsocradar.io+1Jan 2024 – Nov 2024 · 4 undated

Reports are matched by finding the exact id CVE-2023-3519 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Trend Micro19 Nov 2024

Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

LAC reported the multiple campaigns, abusing Array AG (CVE-2023-28461) and Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.

Original (opens in a new tab) ↗

socradar.io24 Jan 2024

Dark Web Profile: INC Ransom

…a combination of advanced techniques, including spear-phishing campaigns to gain initial access, exploitation of known vulnerabilities (such as CVE-2023-3519 in Citrix NetScaler), and the use of both Commercial Off-The-Shelf (COTS) softwares and legitimate system tools (LOLBINs) for reconnaissance and lateral…

2 passages name itOriginal (opens in a new tab) ↗

picussecurity.comUndated

Picus-RedReport-2024

In a notable instance involving the exploitation of Citrix CVE-2023-3519, detailed in CISA's…

3 passages name itOriginal (opens in a new tab) ↗

ZscalerUndated

Return of the Higaisa APT

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

Show all 6 reportsShow fewer

ZscalerUndated

APT-31 Leverages COVID-19 Vaccine Theme

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

ZscalerUndated

Technical Analysis of PureCrypter

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability28 Oct 2026
Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
44 more on OTX

References

3 links, grouped by NVD tag (2 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 19 Jul 2023. Federal due date 9 Aug 2023. Known ransomware use.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ENISA

Marked exploited since 19 Jul 2023. EUVD-2023-44176

Public exploitAdvisories link exploit code.

, 30 Oct 2026

99.7%Top 0.05%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.95%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 1201 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9995 20.0/20

Threat reports6 reports 10.0/10

Public exploit code1 NVD reference tagged Exploit; 13 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total89.9

Record

Published: 19 Jul 2023
Modified: 5 Aug 2026
: CWE-94 Improper Control of Generation of Code
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

3What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

DiscoveryTA0007

Command and ControlTA0011

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

Dark Web Profile: INC Ransom

Picus-RedReport-2024

Return of the Higaisa APT

APT-31 Leverages COVID-19 Vaccine Theme

Technical Analysis of PureCrypter

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 1

How attackers get in

What they do

What can follow

techniques